The Sandbox to Compensate Users 1:1 for SAND Bridge Hack, Claims No Ethereum Supply Affected

ChainCatcher report: The Sandbox has issued an update regarding the security breach of its SAND cross-chain bridge. The company stated that the attacker exploited a vulnerability by modifying the verification mechanism to forge cross-chain deposit messages and mint unsponsored SAND tokens, resulting in approximately 14.7423 million SAND being withdrawn, valued at around $697,000. Additionally, some unsponsored SAND was sold on the market, leading to an overall economic impact of approximately $1.497 million, with the attacker ultimately gaining about $987,000. The Sandbox confirmed that the attack did not affect the SAND supply on Ethereum or Polygon; the total supply of SAND on Ethereum remains unchanged at 3 billion tokens, and no super-admin privileges were compromised. The vulnerability arose from a combination of a generic call function in the token contract and the bridge’s permission design. Relevant addresses have been flagged, and The Sandbox is collaborating with exchanges, security firms, and the LayerZero team. For affected users, The Sandbox has committed to compensating wallets that held legitimately bridged SAND at a 1:1 ratio with Ethereum-based SAND, based on an on-chain snapshot taken prior to the attack. The compensation claim process is expected to open within two weeks and will remain available for an additional two weeks.